python-oauth2: _check_signature() ignores the nonce value when validating signed urls

It was found that python-oauth2 did not properly verify the nonce of a signed URL. An attacker able to capture network traffic of a website using OAuth2 authentication could use this flaw to conduct replay attacks against that website...

Important: Red Hat Security Advisory: Red Hat Satellite 6.1.1 on RHEL 7

Red Hat Satellite 6.1 now available for Red Hat Enterprise Linux 7. Red Hat Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, remote management and monitoring of multiple Linux deployments with a single, centralized tool. It performs provisioning...

zf-oauth2 security bypass vulnerability

OAuth is an open web standard for authorization that is widely used around the world and is currently in version 2.0. A security bypass vulnerability exists in zf-oauth2, which can be exploited by an attacker to bypass security restrictions and perform unauthorized operations...

backstage-oauth2 (>=0.1.7, <=0.1.8), bower-cache (0.5.0) +30 more potentially affected by CVE-2015-5143 via django (>=1.5.12, <=1.7.8)

django PYPI version =1.5.12, =0.1.7, =3.1.0, =0.1.17, =0.3.2, =0.10.0, =0.1.1, =0.1.1, =0.1.0, =0.2.0 - django-live-notification 0.0.0 - django-livefield 2.0.0 - django-manager-utils 0.6.6 and more Source cves: CVE-2015-5143 Source advisory: OSV:PYSEC-2015-20...

Vimeo: API: missing invalidation of OAuth2 Authorization Code during access revocation causes authorization bypass

OAuth2 API makes it possible for users to grant access to their accounts to some third-side applications. Of course, users are able to manage such applications' access to their accounts and may deny access for any application. When some user denies access for the application, all accesstokens are...

backstage-oauth2 (>=0.1.7, <=0.1.8), dbaas-aclapi (>=0.1.17, <=1.0.14) +4 more potentially affected by CVE-2015-2317 via django (>=1.5.12, <=1.6.10)

django PYPI version =1.5.12, =0.1.7, =0.1.17, =0.10.0, =0.10.2 - django-pesapal 0.2.0 - salmon 0.2.0 Source cves: CVE-2015-2317 Source advisory: OSV:PYSEC-2015-9...

backstage-oauth2 (>=0.1.7, <=0.1.8), dbaas-aclapi (>=0.1.17, <=1.0.14) +2 more potentially affected by CVE-2015-2316 via django (>=1.6.1, <=1.6.10)

django PYPI version =1.6.1, =0.1.7, =0.1.17, =1.0.14 - django-pesapal 0.2.0 - salmon 0.2.0 Source cves: CVE-2015-2316 Source advisory: OSV:PYSEC-2015-18...

backstage-oauth2 (>=0.1.7, <=0.1.8), dbaas-aclapi (>=0.1.17, <=1.0.14) +2 more potentially affected by CVE-2015-2316 via django (>=1.6.1, <=1.6.10)

django PYPI version =1.6.1, =0.1.7, =0.1.17, =1.0.14 - django-pesapal 0.2.0 - salmon 0.2.0 Source cves: CVE-2015-2316 Source advisory: MEND:CVE-2015-2316...

WordPress plugin Google Analytics by Yoast stored XSS vulnerability-vulnerability warning-the black bar safety net

WordPress famous plugin Google Analytics by Yoast plug-in exposed storage-typeXSSvulnerability that can allow unauthorized attackers in the WordPress admin panel to store any HTML code, including JavaScript. The administrator to view the plugin Settings panel is a JavaScript will be triggered, do...

QIWI: [qiwi.com] /oauth/confirm.action XSS

Hey hi, I have found a XSS in oauth2 vulnerable link: https://qiwi.com/oauth/confirm.action?redirect=javascript:alert1;/////&clientId=kavsubscribe steps to reproduce: 1 open the following link https://qiwi.com/oauth/confirm.action?redirect=javascript:alert1;/////&clientId=kavsubscribe 2 click...

Fedora 21 : python-oauth2-1.5.211-8.fc21 (2014-12483)

Actually apply patch to fix CVE-2013-4347 thanks to Jason Green, Matt Wilson. Fix CVE-2013-4346 and CVE-2013-4347, thanks to Philippe Makowski. Fix CVE-2013-4346 and CVE-2013-4347, thanks to Philippe Makowski. Note that Tenable Network Security has extracted the preceding description block direct...

[SECURITY] Fedora 21 Update: python-oauth2-1.5.211-8.fc21

Oauth2 was originally forked from Leah Culver and Andy Smith's oauth.py code. Some of the tests come from a fork by Vic Fryzel, while a revamped Request class and more tests were merged in from Mark Paschal's fork. A number of notable differences exist between this code and its forefathers: - 100...

Fedora 20 : python-oauth2-1.5.211-8.fc20 (2014-12475)

Actually apply patch to fix CVE-2013-4347 thanks to Jason Green, Matt Wilson. Fix CVE-2013-4346 and CVE-2013-4347, thanks to Philippe Makowski. Fix CVE-2013-4346 and CVE-2013-4347, thanks to Philippe Makowski. Note that Tenable Network Security has extracted the preceding description block direct...

Fedora 19 : python-oauth2-1.5.211-8.fc19 (2014-12536)

Actually apply patch to fix CVE-2013-4347 thanks to Jason Green, Matt Wilson. Fix CVE-2013-4346 and CVE-2013-4347, thanks to Philippe Makowski. Fix CVE-2013-4346 and CVE-2013-4347, thanks to Philippe Makowski. Note that Tenable Network Security has extracted the preceding description block direct...

Fedora Update for python-oauth2 FEDORA-2014-12475

Check the version of python-oauth2 SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.868433";...

Fedora Update for python-oauth2 FEDORA-2014-12536

Check the version of python-oauth2 SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.868428";...

[SECURITY] Fedora 20 Update: python-oauth2-1.5.211-8.fc20

Oauth2 was originally forked from Leah Culver and Andy Smith's oauth.py code. Some of the tests come from a fork by Vic Fryzel, while a revamped Request class and more tests were merged in from Mark Paschal's fork. A number of notable differences exist between this code and its forefathers: - 100...

[SECURITY] Fedora 19 Update: python-oauth2-1.5.211-8.fc19

Oauth2 was originally forked from Leah Culver and Andy Smith's oauth.py code. Some of the tests come from a fork by Vic Fryzel, while a revamped Request class and more tests were merged in from Mark Paschal's fork. A number of notable differences exist between this code and its forefathers: - 100...

Amazon Linux AMI : python-oauth2 (ALAS-2014-425)

The Server.verifyrequest function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL. The 1 makenonce, 2 generatenonce, and 3 generateverifier functions in SimpleGeo python-oauth2 uses weak random numbers to generate nonce...

SA-CONTRIB-2014-096 - OAuth2 Client - Cross Site Scripting (XSS)

OAuth2 Client is an API support module, enabling other modules to connect to services using OAuth2 authentication. Within its API code the Client class exposes variables in an error message, which originate from a third party source without proper sanitisation thus leading to a Cross Site Scripti...